tpm-key_attestation 0.12.0 → 0.13.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (17) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +49 -3
  3. data/Appraisals +4 -0
  4. data/CHANGELOG.md +11 -0
  5. data/Gemfile +1 -1
  6. data/Gemfile.lock +30 -28
  7. data/gemfiles/openssl_2_1.gemfile +1 -1
  8. data/gemfiles/openssl_2_2.gemfile +1 -1
  9. data/gemfiles/openssl_3_0.gemfile +1 -1
  10. data/gemfiles/openssl_3_1.gemfile +1 -1
  11. data/gemfiles/openssl_3_2.gemfile +12 -0
  12. data/lib/tpm/certify_validator.rb +7 -11
  13. data/lib/tpm/key_attestation/version.rb +1 -1
  14. data/lib/tpm/key_attestation.rb +2 -1
  15. data/lib/tpm/t_public.rb +8 -3
  16. data/lib/tpm/tpms_ecc_point.rb +12 -0
  17. metadata +5 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: fe02507111938501d687c21a2a8461f086ca5ddd1b2d2f2715921a94ee249260
4
- data.tar.gz: 3c7f0f3e79819bdd00e11febc517083320c40c8e4033c328654b64fe9eb88549
3
+ metadata.gz: c9e6f949c61e23e0614e570ac3eaeb2d1649d72af8681612cabe4df72b11c76b
4
+ data.tar.gz: d72f892493994557c4afb2547a9cfd78f9e75bd6a01b2d9026ad50028dc09c89
5
5
  SHA512:
6
- metadata.gz: 0f77dbedcd721d3c06f6ec33a862f89c02360e913776a0c54847cf240b7af1d9ecde6b1bc1d2e1634b7342859bde36038a30aee8f1a85447a1afb494efd4506e
7
- data.tar.gz: cac3351b83246f7c21f542a8c22043b99bdd73a7e218e25064f06785f173303f976aea9b2ffd13ac845e0f0155663543c74f3076f8c099b58db351ec4c823b0f
6
+ metadata.gz: be7db9415c8e0e3dc8182f3a5c5483ed410e70e2096552efc65426b92209df500057f34440006a16fa39a39121b47bd49987073a3588f029ed74267d38651d6d
7
+ data.tar.gz: a4aef2663a09171e1388db3ab116c5526766363e50beb5ac7b991988d2796c69527647ff9b49fa1863a9ff364ef4c5085cb5449abddc77d4e16347addd53bfe5
data/.github/workflows/build.yml CHANGED
@@ -7,15 +7,24 @@
7
7
 
8
8
  name: build
9
9
 
10
- on: push
10
+ on:
11
+ push:
12
+ branches: [master]
13
+ pull_request:
14
+ types: [opened, synchronize]
11
15
 
12
16
  jobs:
13
17
  test:
14
- runs-on: ubuntu-20.04
18
+ runs-on: ${{ matrix.os }}
15
19
  strategy:
16
20
  fail-fast: false
17
21
  matrix:
22
+ os:
23
+ - ubuntu-20.04
24
+ - windows-latest
25
+ - macos-13
18
26
  ruby:
27
+ - '3.3'
19
28
  - '3.2'
20
29
  - '3.1'
21
30
  - '3.0'
@@ -28,6 +37,7 @@ jobs:
28
37
  - openssl_2_1
29
38
  - openssl_3_0
30
39
  - openssl_3_1
40
+ - openssl_3_2
31
41
  exclude:
32
42
  - ruby: '2.4'
33
43
  gemfile: openssl_3_0
@@ -37,10 +47,46 @@ jobs:
37
47
  gemfile: openssl_3_1
38
48
  - ruby: '2.5'
39
49
  gemfile: openssl_3_1
50
+ - ruby: '2.4'
51
+ gemfile: openssl_3_2
52
+ - ruby: '2.5'
53
+ gemfile: openssl_3_2
54
+ - ruby: '2.6'
55
+ gemfile: openssl_3_2
56
+ - ruby: '3.1'
57
+ gemfile: openssl_2_2
58
+ os: macos-13
59
+ - ruby: '3.1'
60
+ gemfile: openssl_2_1
61
+ os: macos-13
62
+ - ruby: '3.2'
63
+ gemfile: openssl_2_2
64
+ os: macos-13
65
+ - ruby: '3.2'
66
+ gemfile: openssl_2_1
67
+ os: macos-13
68
+ - ruby: '3.2'
69
+ gemfile: openssl_2_2
70
+ os: windows-latest
71
+ - ruby: '3.2'
72
+ gemfile: openssl_2_1
73
+ os: windows-latest
74
+ - ruby: '3.3'
75
+ gemfile: openssl_2_2
76
+ os: macos-13
77
+ - ruby: '3.3'
78
+ gemfile: openssl_2_1
79
+ os: macos-13
80
+ - ruby: '3.3'
81
+ gemfile: openssl_2_2
82
+ os: windows-latest
83
+ - ruby: '3.3'
84
+ gemfile: openssl_2_1
85
+ os: windows-latest
40
86
  env:
41
87
  BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
42
88
  steps:
43
- - uses: actions/checkout@v2
89
+ - uses: actions/checkout@v4
44
90
  - run: rm Gemfile.lock
45
91
  - uses: ruby/setup-ruby@v1
46
92
  with:
data/Appraisals CHANGED
@@ -15,3 +15,7 @@ end
15
15
  appraise "openssl_3_1" do
16
16
  gem "openssl", "~> 3.1.0"
17
17
  end
18
+
19
+ appraise "openssl_3_2" do
20
+ gem "openssl", "~> 3.2.0"
21
+ end
data/CHANGELOG.md CHANGED
@@ -1,5 +1,15 @@
1
1
  # Changelog
2
2
 
3
+ ## [v0.13.0] - 2025-01-21
4
+
5
+ - Use public key from AIK cert for signature algorithm initalization [@santiagorodriguez96]
6
+ - Support algorithm being ECC and pubArea's scheme parameter being TPM_ALG_NULL [@santiagorodriguez96]
7
+ - Allow TPM:TPublic to handle ECC keys in pubArea correctly [@santiagorodriguez96]
8
+
9
+ ## [v0.12.1] - 2024-08-05
10
+
11
+ - Fix loading trusted certificates on Windows. #20 & #21 [@johnnyshields], [@salmanasiddiqui]
12
+
3
13
  ## [v0.12.0] - 2022-07-05
4
14
 
5
15
  - Loose OpenSSL dependency to support 3.2 users. Credits to @stanhu <3
@@ -75,6 +85,7 @@ replacement of `JOSE` format `algorithm` string
75
85
  - `TPM::EKCertificate` wrapper
76
86
  - `TPM::SAttest` wrapper
77
87
 
88
+ [v0.13.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.12.1...v0.13.0/
78
89
  [v0.12.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.11.0...v0.12.0/
79
90
  [v0.11.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.10.0...v0.11.0/
80
91
  [v0.10.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.9.0...v0.10.0/
data/Gemfile CHANGED
@@ -5,7 +5,7 @@ source "https://rubygems.org"
5
5
  # Specify your gem's dependencies in tpm-key_attestation.gemspec
6
6
  gemspec
7
7
 
8
- gem "appraisal", "~> 2.2.0"
8
+ gem "appraisal", "~> 2.5.0"
9
9
  gem "byebug", "~> 11.0"
10
10
  gem "rake", "~> 13.0"
11
11
  gem "rspec", "~> 3.0"
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- tpm-key_attestation (0.11.0)
4
+ tpm-key_attestation (0.12.1)
5
5
  bindata (~> 2.4)
6
6
  openssl (> 2.0)
7
7
  openssl-signature_algorithm (~> 1.0)
@@ -9,37 +9,39 @@ PATH
9
9
  GEM
10
10
  remote: https://rubygems.org/
11
11
  specs:
12
- appraisal (2.2.0)
12
+ appraisal (2.5.0)
13
13
  bundler
14
14
  rake
15
15
  thor (>= 0.14.0)
16
16
  ast (2.4.2)
17
- bindata (2.4.14)
17
+ bindata (2.5.0)
18
18
  byebug (11.1.3)
19
- diff-lcs (1.4.4)
20
- jaro_winkler (1.5.4)
21
- openssl (3.1.0)
22
- openssl-signature_algorithm (1.2.1)
23
- openssl (> 2.0, < 3.1)
24
- parallel (1.20.1)
25
- parser (3.0.0.0)
19
+ diff-lcs (1.5.1)
20
+ jaro_winkler (1.5.6)
21
+ openssl (3.2.0)
22
+ openssl-signature_algorithm (1.3.0)
23
+ openssl (> 2.0)
24
+ parallel (1.26.3)
25
+ parser (3.3.6.0)
26
26
  ast (~> 2.4.1)
27
- rainbow (3.0.0)
28
- rake (13.0.3)
29
- rexml (3.2.4)
30
- rspec (3.10.0)
31
- rspec-core (~> 3.10.0)
32
- rspec-expectations (~> 3.10.0)
33
- rspec-mocks (~> 3.10.0)
34
- rspec-core (3.10.1)
35
- rspec-support (~> 3.10.0)
36
- rspec-expectations (3.10.1)
27
+ racc
28
+ racc (1.8.1)
29
+ rainbow (3.1.1)
30
+ rake (13.2.1)
31
+ rexml (3.3.9)
32
+ rspec (3.13.0)
33
+ rspec-core (~> 3.13.0)
34
+ rspec-expectations (~> 3.13.0)
35
+ rspec-mocks (~> 3.13.0)
36
+ rspec-core (3.13.2)
37
+ rspec-support (~> 3.13.0)
38
+ rspec-expectations (3.13.3)
37
39
  diff-lcs (>= 1.2.0, < 2.0)
38
- rspec-support (~> 3.10.0)
39
- rspec-mocks (3.10.2)
40
+ rspec-support (~> 3.13.0)
41
+ rspec-mocks (3.13.2)
40
42
  diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.10.0)
42
- rspec-support (3.10.2)
43
+ rspec-support (~> 3.13.0)
44
+ rspec-support (3.13.2)
43
45
  rubocop (0.80.1)
44
46
  jaro_winkler (~> 1.5.1)
45
47
  parallel (~> 1.10)
@@ -48,15 +50,15 @@ GEM
48
50
  rexml
49
51
  ruby-progressbar (~> 1.7)
50
52
  unicode-display_width (>= 1.4.0, < 1.7)
51
- ruby-progressbar (1.11.0)
52
- thor (1.1.0)
53
+ ruby-progressbar (1.13.0)
54
+ thor (1.3.2)
53
55
  unicode-display_width (1.6.1)
54
56
 
55
57
  PLATFORMS
56
58
  ruby
57
59
 
58
60
  DEPENDENCIES
59
- appraisal (~> 2.2.0)
61
+ appraisal (~> 2.5.0)
60
62
  byebug (~> 11.0)
61
63
  rake (~> 13.0)
62
64
  rspec (~> 3.0)
@@ -64,4 +66,4 @@ DEPENDENCIES
64
66
  tpm-key_attestation!
65
67
 
66
68
  BUNDLED WITH
67
- 2.2.8
69
+ 2.5.23
data/gemfiles/openssl_2_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_2_2.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_0.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_2.gemfile ADDED
@@ -0,0 +1,12 @@
1
+ # This file was generated by Appraisal
2
+
3
+ source "https://rubygems.org"
4
+
5
+ gem "appraisal", "~> 2.5.0"
6
+ gem "byebug", "~> 11.0"
7
+ gem "rake", "~> 13.0"
8
+ gem "rspec", "~> 3.0"
9
+ gem "rubocop", "~> 0.80.1"
10
+ gem "openssl", "~> 3.2.0"
11
+
12
+ gemspec path: "../"
data/lib/tpm/certify_validator.rb CHANGED
@@ -44,7 +44,13 @@ module TPM
44
44
  end
45
45
 
46
46
  def valid_signature?(verify_key)
47
- openssl_signature_algorithm = openssl_signature_algorithm_class.new(**openssl_signature_algorithm_parameters)
47
+ parameters = { hash_function: openssl_hash_function }
48
+
49
+ if verify_key.is_a?(OpenSSL::PKey::EC) || verify_key.is_a?(OpenSSL::PKey::EC::Point)
50
+ parameters[:curve] = verify_key.group.curve_name
51
+ end
52
+
53
+ openssl_signature_algorithm = openssl_signature_algorithm_class.new(**parameters)
48
54
  openssl_signature_algorithm.verify_key = verify_key
49
55
  openssl_signature_algorithm.verify(signature, info)
50
56
  rescue OpenSSL::SignatureAlgorithm::Error
@@ -55,16 +61,6 @@ module TPM
55
61
  @attest ||= TPM::SAttest.deserialize(info)
56
62
  end
57
63
 
58
- def openssl_signature_algorithm_parameters
59
- parameters = { hash_function: openssl_hash_function }
60
-
61
- if public_area.ecc?
62
- parameters[:curve] = public_area.openssl_curve_name
63
- end
64
-
65
- parameters
66
- end
67
-
68
64
  def openssl_hash_function
69
65
  TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
70
66
  end
data/lib/tpm/key_attestation/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module TPM
4
4
  class KeyAttestation
5
- VERSION = "0.12.0"
5
+ VERSION = "0.13.0"
6
6
  end
7
7
  end
data/lib/tpm/key_attestation.rb CHANGED
@@ -15,7 +15,8 @@ module TPM
15
15
  begin
16
16
  pattern = File.expand_path(File.join(__dir__, "certificates", "*", "RootCA", "*.*"))
17
17
  Dir.glob(pattern).map do |filename|
18
- File.open(filename) { |file| OpenSSL::X509::Certificate.new(file) }
18
+ file = File.binread(filename)
19
+ OpenSSL::X509::Certificate.new(file)
19
20
  end
20
21
  end
21
22
 
data/lib/tpm/t_public.rb CHANGED
@@ -4,6 +4,7 @@ require "bindata"
4
4
  require "openssl"
5
5
  require "tpm/constants"
6
6
  require "tpm/sized_buffer"
7
+ require "tpm/tpms_ecc_point"
7
8
  require "tpm/t_public/s_ecc_parms"
8
9
  require "tpm/t_public/s_rsa_parms"
9
10
 
@@ -42,7 +43,7 @@ module TPM
42
43
  end
43
44
 
44
45
  choice :unique, selection: :alg_type do
45
- sized_buffer TPM::ALG_ECC
46
+ tpms_ecc_point TPM::ALG_ECC
46
47
  sized_buffer TPM::ALG_RSA
47
48
  end
48
49
 
@@ -75,9 +76,13 @@ module TPM
75
76
  private
76
77
 
77
78
  def ecc_key
78
- if parameters.scheme == TPM::ALG_ECDSA
79
+ case parameters.scheme
80
+ when TPM::ALG_ECDSA, TPM::ALG_NULL
79
81
  group = OpenSSL::PKey::EC::Group.new(openssl_curve_name)
80
- point = OpenSSL::PKey::EC::Point.new(group, bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.buffer.value))
82
+ point = OpenSSL::PKey::EC::Point.new(
83
+ group,
84
+ bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.x.buffer.value + unique.y.buffer.value)
85
+ )
81
86
 
82
87
  # RFC5480 SubjectPublicKeyInfo
83
88
  asn1 = OpenSSL::ASN1::Sequence(
data/lib/tpm/tpms_ecc_point.rb ADDED
@@ -0,0 +1,12 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bindata"
4
+
5
+ module TPM
6
+ class TpmsEccPoint < BinData::Record
7
+ endian :big
8
+
9
+ sized_buffer :x
10
+ sized_buffer :y
11
+ end
12
+ end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: tpm-key_attestation
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.12.0
4
+ version: 0.13.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Gonzalo
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2023-02-15 00:00:00.000000000 Z
11
+ date: 2025-01-22 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bindata
@@ -76,6 +76,7 @@ files:
76
76
  - gemfiles/openssl_2_2.gemfile
77
77
  - gemfiles/openssl_3_0.gemfile
78
78
  - gemfiles/openssl_3_1.gemfile
79
+ - gemfiles/openssl_3_2.gemfile
79
80
  - lib/tpm/aik_certificate.rb
80
81
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-ECC-RootCA.crt
81
82
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-RSA-RootCA.crt
@@ -115,6 +116,7 @@ files:
115
116
  - lib/tpm/t_public/s_ecc_parms.rb
116
117
  - lib/tpm/t_public/s_rsa_parms.rb
117
118
  - lib/tpm/tpm2b_name.rb
119
+ - lib/tpm/tpms_ecc_point.rb
118
120
  - lib/tpm/tpmt_ha.rb
119
121
  - tpm-key_attestation.gemspec
120
122
  homepage: https://github.com/cedarcode/tpm-key_attestation
@@ -139,7 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
139
141
  - !ruby/object:Gem::Version
140
142
  version: '0'
141
143
  requirements: []
142
- rubygems_version: 3.2.32
144
+ rubygems_version: 3.5.11
143
145
  signing_key:
144
146
  specification_version: 4
145
147
  summary: TPM Key Attestation verifier